src/rootcheck/db/win_audit_rcl.txt

   1 # @(#) $Id: ./src/rootcheck/db/win_audit_rcl.txt, 2011/09/08 dcid Exp $
   2
   3 #
   4 # OSSEC Windows Audit - (C) 2007 Daniel B. Cid - dcid@ossec.net
   5 #
   6 # Released under the same license as OSSEC.
   7 # More details at the LICENSE file included with OSSEC or online
   8 # at: http://www.ossec.net/en/licensing.html
   9 #
  10 # [Application name] [any or all] [reference]
  11 # type:<entry name>;
  12 #
  13 # Type can be:
  14 #             - f (for file or directory)
  15 #             - r (registry entry)
  16 #             - p (process running)
  17 #
  18 # Additional values:
  19 # For the registry , use "->" to look for a specific entry and another
  20 # "->" to look for the value.
  21 # For files, use "->" to look for a specific value in the file.
  22 #
  23 # Values can be preceeded by: =: (for equal) - default
  24 #                             r: (for ossec regexes)
  25 #                             >: (for strcmp greater)
  26 #                             <: (for strcmp  lower)
  27 # Multiple patterns can be specified by using " && " between them.
  28 # (All of them must match for it to return true).
  29
  30
  31
  32
  33 # http://technet2.microsoft.com/windowsserver/en/library/486896ba-dfa1-4850-9875-13764f749bba1033.mspx?mfr=true
  34 [Disabled Registry tools set] [any] []
  35 r:HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools -> 1;
  36 r:HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System -> DisableRegistryTools -> 1;
  37
  38
  39
  40 # http://support.microsoft.com/kb/825750
  41 [DCOM disabled] [any] []
  42 r:HKEY_LOCAL_MACHINE\Software\Microsoft\OLE -> EnableDCOM -> N;
  43
  44
  45
  46 # http://web.mit.edu/is/topics/windows/server/winmitedu/security.html
  47 [LM authentication allowed (weak passwords)] [any] []
  48 r:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA -> LMCompatibilityLevel -> 0;
  49 r:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA -> LMCompatibilityLevel -> 1;
  50
  51
  52
  53 # http://research.eeye.com/html/alerts/AL20060813.html
  54 # Disabled by some Malwares (sometimes by McAfee and Symantec
  55 # security center too).
  56 [Firewall/Anti Virus notification disabled] [any] []
  57 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> FirewallDisableNotify -> !0;
  58 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> antivirusoverride -> !0;
  59 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> firewalldisablenotify -> !0;
  60 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center -> firewalldisableoverride -> !0;
  61
  62
  63
  64 # Checking for the microsoft firewall.
  65 [Microsoft Firewall disabled] [all] []
  66 r:HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\domainprofile -> enablefirewall -> 0;
  67 r:HKEY_LOCAL_MACHINE\software\policies\microsoft\windowsfirewall\standardprofile -> enablefirewall -> 0;
  68
  69
  70
  71 #http://web.mit.edu/is/topics/windows/server/winmitedu/security.html
  72 [Null sessions allowed] [any] []
  73 r:HKLM\System\CurrentControlSet\Control\Lsa -> RestrictAnonymous -> 0;
  74
  75
  76
  77 [Error reporting disabled] [any] [http://windowsir.blogspot.com/2007/04/something-new-to-look-for.html]
  78 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> DoReport -> 0;
  79 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeKernelFaults -> 0;
  80 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeMicrosoftApps -> 0;
  81 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeWindowsApps -> 0;
  82 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> IncludeShutdownErrs -> 0;
  83 r:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PCHealth\ErrorReporting -> ShowUI -> 0;
  84
  85
  86
  87 # http://support.microsoft.com/default.aspx?scid=315231
  88 [Automatic Logon enabled] [any] [http://support.microsoft.com/default.aspx?scid=315231]
  89 r:HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon -> DefaultPassword;
  90 r:HKLM\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\Winlogon -> AutoAdminLogon -> 1;
  91
  92
  93 [Winpcap packet filter driver found] [any] []
  94 f:%WINDIR%\System32\drivers\npf.sys;
  95
  96
  97 # EOF #